Dashboards & Visualizations

Why are the colors in my bar chart not changing as desired?

rkaakaty
Path Finder

So I am trying to change the colors of each bar value. I am not sure why it isnt' working.

Here is my code:

<dashboard>
  <label>Type_Panel</label>
  <row>
    <panel>
      <chart>
        <search>
          <query>eventtype=qualys_vm_detection_event STATUS!="FIXED"
| fillnull value=- PROTOCOL
| table TYPE, QID
| stats count by TYPE</query>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
        <option name="charting.axisTitleX.visibility">visible</option>
        <option name="charting.axisTitleY.visibility">visible</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.enabled">0</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.chart">column</option>
        <option name="charting.chart.bubbleMaximumSize">50</option>
        <option name="charting.chart.bubbleMinimumSize">10</option>
        <option name="charting.chart.bubbleSizeBy">area</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.showDataLabels">none</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">default</option>
        <option name="charting.chart.style">shiny</option>
        <option name="charting.drilldown">all</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.placement">right</option>
        <option name="charting.fieldColors">
         {"CONFIRMED": 0xFF0000, "Potential": 0xF87217}
       </option>
      </chart>
    </panel>
  </row>
</dashboard>

Here is the picture of my current bar graph when I save that code:

alt text

0 Karma

cmerriman
Super Champion

Instead of the fieldColors option, try using the seriesColors option.

0 Karma

somesoni2
SplunkTrust
SplunkTrust

The fieldColors expect that "CONFIRMED" and "Potential" are column/field names not values. Your stats command has column/field name as TYPE. Try this search

eventtype=qualys_vm_detection_event STATUS!="FIXED"
 | fillnull value=- PROTOCOL
 | table TYPE, QID | eval temp=1
 | chart count by temp TYPE | fields - temp

OR

 eventtype=qualys_vm_detection_event STATUS!="FIXED"
 | fillnull value=- PROTOCOL
 | table TYPE, QID
 | stats count(eval(TYPE="CONFIRMED")) as CONFIRMED count(eval(TYPE="Potential")) as Potential

rkaakaty
Path Finder

these options did not work for me

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...